Wikipedia:Sockpuppet investigations/SpaghetticodeV

SpaghetticodeV

SpaghetticodeV (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

07 May 2025

– A checkuser has completed a check on relevant users in this case, and it is now awaiting administration and close.

Suspected sockpuppets

Putongpengyou (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
BettinoD (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
KnownStormChaser (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
Tools: Editor interaction utility · Interaction Timeline · SPI Tools

The NordVPN article has recently received a string of promotional edits that I suspect may be undisclosed paid editing:

4 April: SpaghetticodeV cited a highly promotional post with affiliate links to NordVPN and a call to action on the blog "Insider Gaming"
9 April: Putongpengyou cited a highly promotional review with affiliate links to NordVPN and a call to action on the product comparison site "Comparitech". The content included the ad-like text "boosting its claim to be the most advanced VPN app on the market" and text with the trademark symbol, i.e. "Threat Protection Pro™".
28 April: BettinoD added a list of "awards" from sites containing affiliate links to NordVPN and cited NordVPN marketing pages such as "Get our Emergency VPN Assistance for FREE".
29 April: KnownStormChaser obscured NordVPN's Lithuanian origins to claim that NordVPN is Panamanian, citing a NordVPN support page that presents the Panama jurisdiction as a security benefit. KnownStormChaser also deleted my talk page notifications about conflict-of-interest editing on 30 April.

This editing pattern from accounts with minimal editing activity gives me the impression that the promotional article changes are coordinated. Requesting CheckUser to determine whether the March and April 2025 edits are technically linked. See also the noticeboard discussion at WP:COIN § NordVPN. — Newslinger talk 10:14, 7 May 2025 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

Unrelated. PhilKnight (talk) 11:26, 7 May 2025 (UTC)[reply]
Add Vinny.navey56 (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) too. Putongpengyou signed up on 2020-07-22 07:33 (zhwiki), Vinny.navey56 on 2020-07-28 09:20 (enwiki) and BettinoD on 2020-07-28 10:39 (itwiki). The three of them with mostly no activity until 2024. It seems quite implausible to me that they all signed up in this short time frame, and came back after so long, all for NordVPN, just by chance. It has all the tells for UPE, including strict Monday-Friday timecards, in European business hours (except KnownStormChaser). MarioGom (talk) 22:43, 7 May 2025 (UTC)[reply]